Network segmentation has existed for over a decade and has been implemented in multiple forms and shapes. At its most rudimentary level, segmentation provides traffic isolation. The most common forms of network segmentation are virtual LANs, or VLANs, for Layer 2 solutions, and virtual routing and forwarding, or VRF, for Layer 3 solutions.

One inherent limitation of segmentation is its scope. Segmentation solutions either are complex or are limited to a single device or pair of devices connected using an interface. As an example, Layer 3 segmentation provides the following:

• Ability to group prefixes into a unique route table (RIB or FIB).

• Ability to associate an interface with a route table so that traffic traversing the interface is routed based on prefixes in that route table.

This is a useful functionality, but its scope is limited to a single device. To extend the functionality throughout the network, the segmentation information needs to be carried to the relevant points in the network.

• An enterprise wants to keep different lines of business separate (for example, for security or audit reasons).

• The IT department wants to keep authenticated users separate from guest users.

• A retail store wants to separate video surveillance traffic from transactional traffic.

• An enterprise wants to give business partners selective access only to some portions of the network.

• A service or business needs to enforce regulatory compliance, such as compliance with HIPAA, the U.S. Health Insurance Portability and Accountability Act, or with the Payment Card Industry (PCI) security standards.

• A service provider wants to provide VPN services to its medium-sized enterprises.

There are two approaches to providing this network-wide segmentation:

• Define the grouping policy at every device and on every link in the network (basically, you perform Steps 1 and 2 above on every device).

• Define the grouping policy at the edges of the segment, and then carry the segmentation information in the packets for intermediate nodes to handle.

The first approach is useful if every device is an entry or exit point for the segment, which is generally not the case in medium and large networks. The second approach is much more scalable and keeps the transport network free of segments and complexity.

In Cisco SD-WAN Manager, use a CLI template to configure VRFs for a device. For each VRF, configure a subinterface and link the subinterface to the VRF. You can configure up to 300 VRFs.

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.13.1a, you can configure up to 2,000 VRFs in the overlay network and up to 500 VRFs for a single device. Each VRF deals with fewer routes than before, making the distribution of routes across the network more efficient and easier to scale.

When you push a CLI template to a device, Cisco SD-WAN Manager overwrites existing configuration on the device and loads the configuration defined in the CLI template. Consequently, the template cannot only provide the new content being configured, such as VRFs. The CLI template must include all the configuration details required by the device. To display the relevant configuration details on a device, use the show sdwan running-config command.

For details about creating and applying CLI templates, and for an example of configuring VRFs, see the CLI Templates for Cisco IOS XE Catalyst SD-WAN Routers chapter of the Systems and Interfaces Configuration Guide, Cisco IOS XE Release 17.x.

The following are the supported devices:

• Cisco ASR1001-HX

• ASR1002-HX

• C8500-12X

• C8500-12X4QC

• C8500L-8S4X

• C8500-20X6C

To configure basic VPN parameters, choose Basic Configuration and then configure the following parameters. Parameters marked with an asterisk are required to configure a VPN.

Note	To complete the configuration of the transport VPN on a router, you must configure at least one interface in VPN 0.

To save the feature template, click Save.

Configure Load-Balancing Algorithm Using the CLI

Note	Starting from Cisco IOS XE Catalyst SD-WAN Release 17.8.1a, you need CLI template to configure the src-only load-sharing algorithm for IPv4 and IPv6 Cisco Catalyst SD-WAN and non Cisco Catalyst SD-WAN traffic. For complete details on the load-sharing algorithm CLI, see IP Commands list.

This following provides CLI configurations for selecting a Cisco Express Forwarding load-balancing algorithm for non Cisco Catalyst SD-WAN IPv4 and IPv6 traffic. You can enable ECMP keying to send the configurations for both IPv4 and IPv6.

Device# config-transaction
Device(config)# ip cef load-sharing algorithm {universal [id] | include-ports [ source [id] | destination [id]] |
src-only [id]}

Device# config-transaction
Device(config)# ipv6 cef load-sharing algorithm {universal [id] | include-ports [ source [id] | destination [id]] |
src-only [id]}

This following provides CLI configurations for enabling load balancing algorithm on an interface for Cisco Catalyst SD-WAN IPv4 and IPv6 traffic. You can enable ECMP keying to send the configurations for both IPv4 and IPv6.

Device# config-transaction
Device(config)# sdwan
Device(config-sdwan)# ip load-sharing algorithm {ip-and-ports | src-dst-ip | src-ip-only}

Device# config-transaction
Device(config)# sdwan
Device(config-sdwan)# ipv6 load-sharing algorithm {ip-and-ports | src-dst-ip | src-ip-only}

To configure basic interface functionality in a VPN, choose Basic Configuration and configure the following parameters:

Note	Parameters marked with an asterisk are required to configure an interface.

To save the feature template, click Save.

On Cisco IOS XE Catalyst SD-WAN devices, you can configure up to eight tunnel interfaces. This means that each Cisco IOS XE Catalyst SD-WAN device router can have up to eight TLOCs. On Cisco Catalyst SD-WAN Controllers and Cisco SD-WAN Manager, you can configure one tunnel interface.

For the control plane to establish itself so that the overlay network can function, you must configure WAN transport interfaces in VPN 0. The WAN interface will enable the flow of tunnel traffic to the overlay. You can add other parameters shown in the table below only after you configure the WAN interface as a tunnel interface.

To configure a tunnel interface, select Interface Tunnel and configure the following parameters:

To configure additional tunnel interface parameters, click Advanced Options:

To configure DNS addresses and static hostname mapping, click DNS and configure the following parameters:

To save the feature template, click Save.

! IP DNS-based host name-to-address translation is enabled
  ip domain lookup
! Specifies hosts 192.168.1.111 and 192.168.1.2 as name servers
  ip name-server 192.168.1.111 192.168.1.2
! Defines cisco.com as the default domain name the device uses to complete
! Set the name for unqualified host names  
  ip domain name cisco.com

To segment user networks and user data traffic locally at each site and to interconnect user sites across the overlay network, you create VRFs on Cisco IOS XE Catalyst SD-WAN devices. To enable the flow of data traffic, you associate interfaces with each VRF, assigning an IP address to each interface. These interfaces connect to local-site networks, not to WAN transport clouds. For each of these VRFs, you can set other interface-specific properties, and you can configure features specific for the user segment, such as BGP and OSPF routing, VRRP, QoS, traffic shaping, and policing.

On Cisco IOS XE Catalyst SD-WAN devices, a global VRF is used for transport. All Cisco IOS XE Catalyst SD-WAN devices have Mgmt-intf as the default management VRF.

To configure VRFs on Cisco IOS XE Catalyst SD-WAN devices, follow these steps.

Note

Use the config-transaction command to open CLI configuration mode. The config terminal command is not supported on Cisco IOS XE Catalyst SD-WAN devices. The VRF ID can be any number between 1 through 511 and 513 through 65535. The numbers 0 and 512 are reserved for Cisco SD-WAN Manager and Cisco SD-WAN Controller.

1. Configure service VRFs.

   
   
   config-transaction
    vrf definition 10
     rd 1:10
     address-family ipv4
      exit-address-family
      exit
    address-family ipv6
     exit-address-family
     exit
   exit
    
   

2. Configure the tunnel interface to be used for overlay connectivity. Each tunnel interface binds to a single WAN interface. For example, if the router interface is Gig0/0/2, the tunnel interface number is 2.

   
   
   config-transaction
    interface Tunnel 2
     no shutdown
     ip unnumbered GigabitEthernet1
     tunnel source GigabitEthernet1
     tunnel mode sdwan
     exit
    
   

3. If the router is not connected to a DHCP server, configure the IP address of the WAN interface.

   
   
    interface GigabitEthernet 1
    no shutdown 
    ip address dhcp  
    
   

4. Configure tunnel parameters.

   
   
   config-transaction
    sdwan
     interface GigabitEthernet 2
      tunnel-interface
       encapsulation ipsec
       color lte
       end
    
   

   Note	If an IP address is manually configured on the router, configure a default route as shown below. The IP address below indicates a next-hop IP address. config-transaction ip route 0.0.0.0 0.0.0.0 192.0.2.25

5. Enable OMP to advertise VRF segment vroutes.

   
   
   sdwan
   omp
    no shutdown
    graceful-restart
    no as-dot-notation
    timers
    holdtime 15
    graceful-restart-timer 120
    exit
   address-family ipv4
    advertise ospf external
    advertise connected
    advertise static
    exit
   address-family ipv6
    advertise ospf external
    advertise connected
    advertise static
    exit
   address-family ipv4 vrf 1
    advertise bgp
    exit
   exit
    
   

6. Configure the service VRF interface.

   
   
   config-transaction
    interface GigabitEthernet 2 
     no shutdown
     vrf forwarding 10
     ip address 192.0.2.2 255.255.255.0
     exit
    
   

Device# sh ip vrf brief
  Name                             Default RD            Interfaces
  10                               1:10                  Gi4
  11                               1:11                  Gi3
  30                               1:30
  65528                            <not set>             Lo65528